[
https://issues.apache.org/jira/browse/BEAM-14169?focusedWorklogId=766822&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-766822
]
ASF GitHub Bot logged work on BEAM-14169:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 05/May/22 17:57
Start Date: 05/May/22 17:57
Worklog Time Spent: 10m
Work Description: elink21 commented on code in PR #17383:
URL: https://github.com/apache/beam/pull/17383#discussion_r866174263
##########
.test-infra/jenkins/job_ClusterCredentialsRotation.groovy:
##########
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import CommonJobProperties as commonJobProperties
+
+job('Rotate Cluster Credentials') {
+ description('Rotates Certificates and performs an IP rotation for metrics
and io-datastores')
+
+ // Set common parameters.
+ commonJobProperties.setTopLevelMainJobProperties(delegate)
+
+ // Sets that this is a cron job.
+ commonJobProperties.setCronJob(delegate, 'H 2 1 */2 *')// At 00:02am every
second month.
+
+ steps {
+
+ //Credentials rotation for metrics and io-datastores
+
+ //Set a maintenance window
+ shell('''gcloud container clusters update metrics \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
+
+ shell('''gcloud container clusters update io-datastores \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
+
+ //Starting credential rotation
+ // it's necessary to rebuild the nodes after rotation to avoid apiservices
issues
+ shell('''gcloud container clusters update metrics \
+ --start-credential-rotation --zone=us-central1-a --quiet''')
+
+ shell('''gcloud container clusters update io-datastores \
+ --start-credential-rotation --zone=us-central1-a --quiet''')
+
+ //Rebuilding the nodes
+ shell('''gcloud container clusters upgrade metrics \
Review Comment:
If anything goes wrong after line 50, GCP will automatically complete the
process after 7 days ([Automatic
completion](https://cloud.google.com/kubernetes-engine/docs/how-to/credential-rotation#performing_a_credential_rotation)).
If something fails during the first 2 commands
(_--start-credential-rotation_), the rotation will not start and the cluster
will keep the previous credentials. We will add a condition to only execute the
following steps if the start-credential-rotation part was successful. I could
also add an email alert in case of failure.
Issue Time Tracking
-------------------
Worklog Id: (was: 766822)
Time Spent: 2h 40m (was: 2.5h)
> Automatically rotate credentials for Kubernetes cluster
> -------------------------------------------------------
>
> Key: BEAM-14169
> URL: https://issues.apache.org/jira/browse/BEAM-14169
> Project: Beam
> Issue Type: Improvement
> Components: testing
> Reporter: Kiley Sok
> Assignee: Elias Edgardo Segundo Antonio
> Priority: P2
> Time Spent: 2h 40m
> Remaining Estimate: 0h
>
> We had to manually rotate the credentials. Set up cron job to rotate every x
> months.
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
